From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Julien Thierry <julien.thierry@arm.com>,
Russell King <rmk+kernel@armlinux.org.uk>,
"David A. Long" <dave.long@linaro.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.9 10/58] ARM: 8796/1: spectre-v1,v1.1: provide helpers for address sanitization
Date: Mon, 18 Feb 2019 14:43:31 +0100 [thread overview]
Message-ID: <20190218133509.370752861@linuxfoundation.org> (raw)
In-Reply-To: <20190218133508.567416115@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit afaf6838f4bc896a711180b702b388b8cfa638fc upstream.
Introduce C and asm helpers to sanitize user address, taking the
address range they target into account.
Use asm helper for existing sanitization in __copy_from_user().
Signed-off-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David A. Long <dave.long@linaro.org>
Reviewed-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/include/asm/assembler.h | 11 +++++++++++
arch/arm/include/asm/uaccess.h | 26 ++++++++++++++++++++++++++
arch/arm/lib/copy_from_user.S | 6 +-----
3 files changed, 38 insertions(+), 5 deletions(-)
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index e616f61f859d..7d727506096f 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -465,6 +465,17 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
#endif
.endm
+ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
+#ifdef CONFIG_CPU_SPECTRE
+ sub \tmp, \limit, #1
+ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
+ addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
+ subhss \tmp, \tmp, \size @ tmp = limit - (addr + size) }
+ movlo \addr, #0 @ if (tmp < 0) addr = NULL
+ csdb
+#endif
+ .endm
+
.macro uaccess_disable, tmp, isb=1
#ifdef CONFIG_CPU_SW_DOMAIN_PAN
/*
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index b61acd62cffb..0f6c6b873bc5 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -129,6 +129,32 @@ static inline void set_fs(mm_segment_t fs)
#define __inttype(x) \
__typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
+/*
+ * Sanitise a uaccess pointer such that it becomes NULL if addr+size
+ * is above the current addr_limit.
+ */
+#define uaccess_mask_range_ptr(ptr, size) \
+ ((__typeof__(ptr))__uaccess_mask_range_ptr(ptr, size))
+static inline void __user *__uaccess_mask_range_ptr(const void __user *ptr,
+ size_t size)
+{
+ void __user *safe_ptr = (void __user *)ptr;
+ unsigned long tmp;
+
+ asm volatile(
+ " sub %1, %3, #1\n"
+ " subs %1, %1, %0\n"
+ " addhs %1, %1, #1\n"
+ " subhss %1, %1, %2\n"
+ " movlo %0, #0\n"
+ : "+r" (safe_ptr), "=&r" (tmp)
+ : "r" (size), "r" (current_thread_info()->addr_limit)
+ : "cc");
+
+ csdb();
+ return safe_ptr;
+}
+
/*
* Single-value transfer routines. They automatically use the right
* size if we just have the right pointer type. Note that the functions
diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
index a826df3d3814..6709a8d33963 100644
--- a/arch/arm/lib/copy_from_user.S
+++ b/arch/arm/lib/copy_from_user.S
@@ -93,11 +93,7 @@ ENTRY(arm_copy_from_user)
#ifdef CONFIG_CPU_SPECTRE
get_thread_info r3
ldr r3, [r3, #TI_ADDR_LIMIT]
- adds ip, r1, r2 @ ip=addr+size
- sub r3, r3, #1 @ addr_limit - 1
- cmpcc ip, r3 @ if (addr+size > addr_limit - 1)
- movcs r1, #0 @ addr = NULL
- csdb
+ uaccess_mask_range_ptr r1, r2, r3, ip
#endif
#include "copy_template.S"
--
2.19.1
next prev parent reply other threads:[~2019-02-18 13:57 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-18 13:43 [PATCH 4.9 00/58] 4.9.159-stable review Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 01/58] dt-bindings: eeprom: at24: add "atmel,24c2048" compatible string Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 02/58] eeprom: at24: add support for 24c2048 Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 03/58] uapi/if_ether.h: prevent redefinition of struct ethhdr Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 04/58] ARM: 8789/1: signal: copy registers using __copy_to_user() Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 05/58] ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 06/58] ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user() Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 07/58] ARM: 8793/1: signal: replace __put_user_error with __put_user Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 08/58] ARM: 8794/1: uaccess: Prevent speculative use of the current addr_limit Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 09/58] ARM: 8795/1: spectre-v1.1: use put_user() for __put_user() Greg Kroah-Hartman
2019-02-18 13:43 ` Greg Kroah-Hartman [this message]
2019-02-18 13:43 ` [PATCH 4.9 11/58] ARM: 8797/1: spectre-v1.1: harden __copy_to_user Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 12/58] ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 13/58] ARM: make lookup_processor_type() non-__init Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 14/58] ARM: split out processor lookup Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 15/58] ARM: clean up per-processor check_bugs method call Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 16/58] ARM: add PROC_VTABLE and PROC_TABLE macros Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 17/58] ARM: spectre-v2: per-CPU vtables to work around big.Little systems Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 18/58] ARM: ensure that processor vtables is not lost after boot Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 19/58] ARM: fix the cockup in the previous patch Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 20/58] net: create skb_gso_validate_mac_len() Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 21/58] bnx2x: disable GSO where gso_size is too big for hardware Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 22/58] ACPI: NUMA: Use correct type for printing addresses on i386-PAE Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 23/58] cpufreq: check if policy is inactive early in __cpufreq_get() Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 24/58] drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 25/58] drm/bridge: tc358767: fix single lane configuration Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 26/58] drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 27/58] drm/bridge: tc358767: reject modes which require too much BW Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 28/58] drm/bridge: tc358767: fix output H/V syncs Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 29/58] ARM: dts: da850-evm: Correct the sound card name Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 30/58] ARM: dts: da850-lcdk: " Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 31/58] ARM: dts: kirkwood: Fix polarity of GPIO fan lines Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 32/58] gpio: pl061: handle failed allocations Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 33/58] cifs: Limit memory used by lock request calls to a page Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 34/58] perf report: Include partial stacks unwound with libdw Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 35/58] Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G" Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 36/58] Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 37/58] perf/core: Fix impossible ring-buffer sizes warning Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 4.9 38/58] perf/x86: Add check_period PMU callback Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 39/58] ALSA: hda - Add quirk for HP EliteBook 840 G5 Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 40/58] ALSA: usb-audio: Fix implicit fb endpoint setup by quirk Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 41/58] kvm: vmx: Fix entry number check for add_atomic_switch_msr() Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 42/58] Input: bma150 - register input device after setting private data Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 43/58] Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 44/58] alpha: fix page fault handling for r16-r18 targets Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 45/58] alpha: Fix Eiger NR_IRQS to 128 Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 46/58] tracing/uprobes: Fix output for multiple string arguments Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 47/58] x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 48/58] signal: Restore the stop PTRACE_EVENT_EXIT Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 49/58] x86/a.out: Clear the dump structure initially Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 50/58] dm thin: fix bug where bio that overwrites thin block ignores FUA Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 51/58] drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 52/58] smsc95xx: Use skb_cow_head to deal with cloned skbs Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 53/58] ch9200: use skb_cow_head() " Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 54/58] kaweth: " Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 55/58] usb: dwc2: Remove unnecessary kfree Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 56/58] netfilter: nf_tables: fix mismatch in big-endian system Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 57/58] pinctrl: msm: fix gpio-hog related boot issues Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 4.9 58/58] mm: stop leaking PageTables Greg Kroah-Hartman
2019-02-18 19:43 ` [PATCH 4.9 00/58] 4.9.159-stable review Naresh Kamboju
2019-02-19 9:31 ` Jon Hunter
2019-02-19 17:26 ` Guenter Roeck
2019-02-20 0:19 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190218133509.370752861@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dave.long@linaro.org \
--cc=julien.thierry@arm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rmk+kernel@armlinux.org.uk \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).